Build/Test Tools: Add some further missing permissions to the GitHub Actions workflows.

These permissions are not required for a public repo but are required for a private repo, for example a private fork.

Props johnbillion, desrosj

Follow-up to r60612.

See #63170

git-svn-id: https://develop.svn.wordpress.org/trunk@60624 602fd350-edb4-49c9-b593-d223f7449a82

Author: johnbillion

.github/workflows/check-built-files.yml

@@ -46,3 +46,5 @@ jobs:
     # This prevents an unnecessary second run after changes are committed back because Dependabot always rebases and force pushes.
     if: ${{ github.repository == 'wordpress/wordpress-develop' && ( github.actor != 'dependabot[bot]' || github.event.commits < 2 ) }}
     uses: ./.github/workflows/reusable-check-built-files.yml
+    permissions:
+      contents: read

.github/workflows/reusable-upgrade-testing.yml

@@ -58,7 +58,8 @@ jobs:
   # - Checks the version of WordPress after the upgrade.
   upgrade-tests:
     name: ${{ inputs.wp }} to ${{ inputs.new-version }} / PHP ${{ inputs.php }} with ${{ 'mariadb' == inputs.db-type && 'MariaDB' || 'MySQL' }} ${{ inputs.db-version }}${{ inputs.multisite && ' multisite' || '' }}
-    permissions: {}
+    permissions:
+      contents: read
     runs-on: ${{ inputs.os }}
     timeout-minutes: 20
 

.github/workflows/upgrade-develop-testing.yml

@@ -57,6 +57,8 @@ jobs:
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
     needs: [ build ]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -90,6 +92,8 @@ jobs:
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository != 'WordPress/wordpress-develop' }}
     needs: [ build ]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/upgrade-testing.yml

@@ -59,6 +59,8 @@ jobs:
     name: ${{ matrix.wp }} to ${{ inputs.new-version && inputs.new-version || 'latest' }}
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -94,6 +96,8 @@ jobs:
     name: ${{ matrix.wp }} to ${{ inputs.new-version && inputs.new-version || 'latest' }}
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -122,6 +126,8 @@ jobs:
     name: ${{ matrix.wp }} to ${{ inputs.new-version && inputs.new-version || 'latest' }}
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -154,6 +160,8 @@ jobs:
     name: ${{ matrix.wp }} to ${{ inputs.new-version && inputs.new-version || 'latest' }}
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -182,6 +190,8 @@ jobs:
     name: ${{ matrix.wp }} to ${{ inputs.new-version && inputs.new-version || 'latest' }}
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: